CISSP Communication and Network Security Practice Question
A company uses SSH for remote administration. To enhance security, they want to implement public-key authentication. Which statement about SSH public-key authentication is true?
⚠ Common exam trap
A common mix-up: candidates confuse the roles of public and private keys, mistakenly thinking the public key is used for decryption or that the private key is stored on the server, when in fact the private key is kept secret by the user and used only for signing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The private key must be kept secret by the user
In SSH public-key authentication, the private key is the secret half of the asymmetric key pair and must be kept confidential by the user. The server stores only the public key, and authentication is proven by the client signing a challenge with the private key, which the server verifies using the stored public key. This ensures that even if the server is compromised, the private key remains safe on the client side.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The private key must be kept secret by the user
Why this is correct
The private key is the core secret in asymmetric cryptography for SSH authentication. Its secrecy is paramount because it uniquely identifies the user and authorizes access to the remote server. If this key is compromised or shared, an attacker can impersonate the legitimate user, bypassing all other security controls. Therefore, users must diligently protect their private keys from unauthorized access and disclosure.
- ✗
The public key is used to decrypt the session
Why it's wrong here
The public key's role in SSH authentication is to encrypt a challenge issued by the server, which can only be decrypted by the corresponding private key held by the client. Session decryption, however, is handled by symmetric encryption algorithms using a shared session key established during the initial key exchange. The public key is not directly involved in decrypting the ongoing data stream of the SSH session itself. Its function is specifically for proving identity during the authentication phase.
- ✗
Public-key authentication does not require a passphrase
Why it's wrong here
While the SSH protocol does not technically mandate a passphrase for a private key to function, employing one is a critical security best practice. A passphrase encrypts the private key file itself, providing an additional layer of protection against unauthorized use should the key file be stolen or accessed by an attacker. Without a passphrase, a compromised private key can be immediately used to authenticate, whereas a passphrase requires an attacker to also crack that secret. This significantly enhances the overall security posture.
- ✗
The private key is stored on the server
Why it's wrong here
The private key must always reside securely on the client machine, never on the server, as it is the user's secret credential for proving identity. Conversely, the public key is stored on the server in the authorized_keys file, allowing the server to verify the client's authenticity without ever needing the private key. This fundamental separation ensures that the client retains sole control over its authentication secret, preventing the server from ever possessing the means to impersonate the client. Storing the private key on the server would negate the security benefits of asymmetric authentication.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.